infection possible de ma clé usb

[kikou45]

après un usage sans prob de ma clé usb sous xp pro sp3, elle est depuis qques jours reconnue comme...disque amovible avec icone en relation. j'accède tjs à son contenu mais je soupçonne une infection. meme sur d'autres ports usb et pc différents meme chose. avast home n'a rien "vu"!

 

j'ai installé et fait tourner combofix;

voici son rapport:

 

ComboFix 10-01-03.05 - Administrateur 04/01/2010 13:44:05.1.2 - x86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1015.490 [GMT 1:00]

Lancé depuis: e:\documents and settings\Administrateur\Mes documents\Downloads\ComboFix.exe

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

D:\Autorun.inf

e:\docume~1\ADMINI~1\LOCALS~1\Temp\install_flash_player.exe

e:\windows\system32\msconfig.exe

 

e:\windows\system32\proquota.exe . . . manque!!

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-12-04 au 2010-01-04 ))))))))))))))))))))))))))))))))))))

.

 

2010-01-04 09:16 . 2009-02-09 02:10 67208 ----a-w- e:\windows\UnDeploy.exe

2010-01-04 08:58 . 2009-11-21 10:18 1673216 ----a-w- e:\windows\system32\BootMan.exe

2010-01-04 08:58 . 2009-09-16 15:55 8456 ----a-w- e:\windows\system32\EuGdiDrv.sys

2010-01-04 08:58 . 2009-09-14 08:21 14848 ----a-w- e:\windows\system32\EuEpmGdi.dll

2010-01-04 08:58 . 2009-08-26 11:45 13192 ----a-w- e:\windows\system32\epmntdrv.sys

2010-01-04 08:58 . 2009-04-22 13:28 86408 ----a-w- e:\windows\system32\setupempdrv03.exe

2010-01-04 08:58 . 2010-01-04 08:58 -------- d-----w- e:\program files\EASEUS

2010-01-03 22:46 . 2010-01-03 23:28 4212 ---ha-w- e:\windows\system32\zllictbl.dat

2010-01-03 22:46 . 2009-09-23 19:04 69000 ----a-w- e:\windows\system32\zlcomm.dll

2010-01-03 22:46 . 2009-09-23 19:04 103816 ----a-w- e:\windows\system32\zlcommdb.dll

2010-01-03 22:46 . 2009-09-23 19:04 1238408 ----a-w- e:\windows\system32\zpeng25.dll

2010-01-03 22:46 . 2010-01-03 22:46 -------- d-----w- e:\windows\system32\ZoneLabs

2010-01-03 22:46 . 2010-01-03 22:46 -------- d-----w- e:\program files\Zone Labs

2010-01-03 22:44 . 2010-01-04 13:12 -------- d-----w- e:\windows\Internet Logs

2010-01-03 21:39 . 2010-01-03 21:50 -------- d-----w- e:\program files\Soft4Ever

2010-01-03 21:35 . 2008-04-13 08:46 11136 ----a-w- e:\windows\system32\drivers\SLIP.sys

2010-01-03 21:14 . 2010-01-03 21:14 -------- d-----w- e:\windows\Downloaded Installations

2010-01-03 14:30 . 2010-01-03 14:30 -------- d-----w- e:\documents and settings\Administrateur\Application Data\Apple Computer

2010-01-03 14:26 . 2010-01-03 14:26 -------- d-----w- e:\program files\QuickTime

2010-01-03 14:26 . 2010-01-03 14:30 -------- d-----w- e:\documents and settings\All Users\Application Data\Apple Computer

2010-01-03 14:25 . 2010-01-03 14:25 -------- d-----w- e:\program files\Fichiers communs\Apple

2010-01-03 14:25 . 2010-01-03 14:25 -------- d-----w- e:\documents and settings\Administrateur\Local Settings\Application Data\Apple

2010-01-03 14:25 . 2010-01-03 14:25 -------- d-----w- e:\program files\Apple Software Update

2010-01-03 14:25 . 2010-01-03 14:25 -------- d-----w- e:\documents and settings\All Users\Application Data\Apple

2010-01-03 14:25 . 2010-01-03 14:25 -------- d-----w- e:\documents and settings\Administrateur\Local Settings\Application Data\Apple Computer

2010-01-02 08:40 . 2010-01-02 08:43 -------- d-----w- e:\documents and settings\Administrateur\Local Settings\Application Data\AskToolbar

2010-01-02 08:38 . 2010-01-02 08:38 -------- d-----w- e:\documents and settings\Administrateur\Application Data\Nero

2010-01-01 21:57 . 2009-12-16 13:42 43008 ----a-w- e:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\h4ajjd4y.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll

2010-01-01 21:57 . 2009-12-16 13:42 872960 ----a-w- e:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\h4ajjd4y.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

2010-01-01 21:57 . 2009-12-16 13:42 340480 ----a-w- e:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\h4ajjd4y.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll

2010-01-01 21:57 . 2009-12-16 13:41 346624 ----a-w- e:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\h4ajjd4y.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll

2010-01-01 08:59 . 2010-01-01 08:59 -------- d-----w- e:\program files\Fontboard

2010-01-01 08:42 . 2008-04-14 12:30 15360 ----a-w- e:\windows\system32\ctfmon.exe

2010-01-01 08:42 . 2008-04-13 18:33 195584 ----a-w- e:\windows\system32\msutb.dll

2010-01-01 00:25 . 2010-01-01 00:25 0 ----a-w- e:\windows\nsreg.dat

2010-01-01 00:25 . 2010-01-01 00:25 -------- d-----w- e:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla

2010-01-01 00:01 . 2010-01-01 00:01 33558 ----a-w- e:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\Firefox_Toolbar_Uninstaller.exe

2009-12-31 23:56 . 2003-06-19 00:31 18944 ----a-w- e:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll

2009-12-31 23:56 . 2003-06-19 00:31 17920 ----a-w- e:\windows\system32\mdimon.dll

2009-12-31 23:55 . 2009-12-31 23:56 -------- d-----w- e:\windows\SHELLNEW

2009-12-31 23:55 . 2009-12-31 23:55 -------- d-----w- e:\program files\Microsoft.NET

2009-12-31 23:53 . 2009-12-31 23:53 -------- d-----r- E:\MSOCache

2009-12-31 23:51 . 2008-04-13 08:39 7552 ----a-w- e:\windows\system32\drivers\MSKSSRV.sys

2009-12-31 23:50 . 2010-01-04 12:49 -------- d-----w- e:\documents and settings\Administrateur\Application Data\Skype

2009-12-31 23:49 . 2008-02-15 11:49 184320 ----a-w- e:\windows\system32\igfxres.dll

2009-12-31 23:35 . 2008-04-13 09:17 83072 ----a-w- e:\windows\system32\drivers\wdmaud.sys

2009-12-31 23:34 . 2008-04-13 16:57 58752 ----a-w- e:\windows\system32\drivers\redbook.sys

2009-12-31 23:34 . 2008-04-13 17:34 153088 ----a-w- e:\windows\system32\irftp.exe

2009-12-31 23:34 . 2008-04-13 17:33 8192 ----a-w- e:\windows\system32\wshirda.dll

2009-12-31 23:34 . 2008-04-13 17:33 29184 ----a-w- e:\windows\system32\irmon.dll

2009-12-31 23:34 . 2008-04-13 09:54 88192 ----a-w- e:\windows\system32\drivers\irda.sys

2009-12-31 23:34 . 2001-08-17 19:51 19584 ----a-w- e:\windows\system32\drivers\rasirda.sys

2009-12-31 23:34 . 2001-08-17 19:51 18688 ----a-w- e:\windows\system32\drivers\irsir.sys

2009-12-31 23:33 . 2008-04-13 16:33 77312 ----a-w- e:\windows\system32\usbui.dll

2009-12-31 23:32 . 2010-01-03 22:44 -------- d-sh--w- e:\windows\Installer

2009-12-31 23:32 . 2010-01-04 13:09 -------- d-----w- E:\Program Files

2009-12-31 23:30 . 2009-12-31 23:41 -------- dc----w- e:\windows\system32\DRVSTORE

2009-12-31 23:30 . 2009-12-31 23:30 -------- d-----w- e:\program files\Intel

2009-12-31 23:30 . 2009-08-26 14:04 53248 ----a-w- e:\windows\system32\CSVer.dll

2009-12-31 23:30 . 2009-12-31 23:30 -------- d-----w- E:\Intel

2009-12-31 23:30 . 2009-12-31 23:30 -------- d-----w- E:\DRIVERS

2009-12-31 23:27 . 2009-11-30 20:27 38848 ----a-w- e:\windows\system32\avastSS.scr

2009-12-31 23:27 . 2009-12-31 23:27 -------- d-----w- e:\program files\ma-config.com

2009-12-31 23:27 . 2009-12-31 23:27 -------- d-----w- e:\documents and settings\All Users\Application Data\ma-config.com

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-04 13:09 . 2010-01-04 13:09 -------- d-----w- e:\program files\microsoft frontpage

2010-01-01 08:26 . 2009-12-31 23:01 11448 ----a-w- e:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-01 00:00 . 2009-12-31 23:00 -------- d-----w- e:\program files\Google

2009-12-31 23:59 . 2009-12-31 23:00 -------- d-----w- e:\documents and settings\All Users\Application Data\Google Updater

2009-12-31 23:42 . 2009-12-31 22:45 -------- d-----w- e:\program files\CCleaner

2009-12-31 23:22 . 2009-12-31 23:22 -------- d-----w- e:\program files\Alwil Software

2009-12-31 23:22 . 2009-12-31 23:22 -------- d-----w- e:\documents and settings\All Users\Application Data\Alwil Software

2009-12-31 23:16 . 2009-12-31 23:16 -------- d-----w- e:\program files\Fichiers communs\Adobe

2009-12-31 23:15 . 2009-12-31 23:15 -------- d-----w- e:\program files\Ask.com

2009-12-31 23:11 . 2009-12-31 23:11 -------- d-----w- e:\program files\Fichiers communs\Real

2009-12-31 23:11 . 2009-12-31 23:11 -------- d-----w- e:\program files\Fichiers communs\xing shared

2009-12-31 23:11 . 2009-12-31 23:11 499712 ----a-w- e:\windows\system32\msvcp71.dll

2009-12-31 23:11 . 2009-12-31 23:11 348160 ----a-w- e:\windows\system32\msvcr71.dll

2009-12-31 23:11 . 2009-12-31 23:11 -------- d-----w- e:\program files\Real

2009-12-31 23:07 . 2009-12-31 23:07 -------- d-----w- e:\program files\Fichiers communs\Skype

2009-12-31 23:07 . 2009-12-31 23:07 -------- d-----r- e:\program files\Skype

2009-12-31 23:07 . 2009-12-31 23:07 -------- d-----w- e:\documents and settings\All Users\Application Data\Skype

2009-12-31 23:00 . 2009-10-23 19:00 70718 ----a-w- e:\windows\system32\perfc00C.dat

2009-12-31 23:00 . 2009-10-23 19:00 455430 ----a-w- e:\windows\system32\perfh00C.dat

2009-12-31 22:45 . 2009-12-31 22:45 -------- d-----w- e:\program files\MPC HomeCinema

2009-12-31 22:45 . 2009-12-31 22:45 -------- d-----w- e:\program files\Symantec

2009-12-31 22:45 . 2009-12-31 22:54 -------- d-----w- e:\documents and settings\Administrateur\Application Data\Symantec

2009-12-31 22:45 . 2009-12-31 22:52 -------- d-----w- e:\windows\system32\config\systemprofile\Application Data\Symantec

2009-12-31 22:45 . 2009-12-31 22:45 -------- d-----w- e:\documents and settings\Default User\Application Data\Symantec

2009-12-31 22:45 . 2009-12-31 22:45 -------- d-----w- e:\program files\Fichiers communs\Symantec Shared

2009-12-31 22:45 . 2009-12-31 22:45 -------- d-----w- e:\documents and settings\All Users\Application Data\Symantec

2009-12-31 22:44 . 2009-12-31 22:44 -------- d-----w- e:\program files\Fichiers communs\Nero

2009-12-31 22:44 . 2009-12-31 22:44 -------- d-----w- e:\program files\Nero

2009-12-31 22:44 . 2009-12-31 22:44 -------- d-----w- e:\documents and settings\All Users\Application Data\Nero

2009-12-31 22:44 . 2009-12-31 22:44 -------- d-----w- e:\program files\Fichiers communs\ACD Systems

2009-12-31 22:44 . 2009-12-31 22:44 -------- d-----w- e:\documents and settings\All Users\Application Data\ACD Systems

2009-12-31 22:44 . 2009-12-31 22:44 -------- d-----w- e:\program files\ACD Systems

2009-12-31 22:43 . 2009-12-31 22:43 -------- d-----w- e:\program files\Fichiers communs\EZB Systems

2009-12-31 22:43 . 2009-12-31 22:43 -------- d-----w- e:\program files\Windows Live

2009-12-31 22:43 . 2009-12-31 22:43 -------- d-----w- e:\program files\Microsoft

2009-12-31 22:39 . 2009-12-31 22:39 2678 ----a-w- e:\windows\java\Packages\Data\HVFLRB77.DAT

2009-12-31 22:39 . 2009-12-31 22:39 2678 ----a-w- e:\windows\java\Packages\Data\XBDBNFH7.DAT

2009-12-31 22:39 . 2009-12-31 22:39 2678 ----a-w- e:\windows\java\Packages\Data\R53Z3PNT.DAT

2009-12-31 22:39 . 2009-12-31 22:39 2678 ----a-w- e:\windows\java\Packages\Data\NFTRXVPN.DAT

2009-12-31 22:39 . 2009-12-31 22:39 2678 ----a-w- e:\windows\java\Packages\Data\KTNVT7Z5.DAT

2009-12-31 22:38 . 2009-12-31 22:38 21892 ----a-w- e:\windows\system32\emptyregdb.dat

2009-11-30 20:26 . 2009-12-31 23:22 150624 ----a-w- e:\windows\system32\aswBoot.exe

2009-11-30 20:15 . 2009-12-31 23:22 46544 ----a-w- e:\windows\system32\drivers\aswTdi.sys

2009-11-30 20:14 . 2009-12-31 23:22 149840 ----a-w- e:\windows\system32\drivers\aswSP.sys

2009-11-30 20:12 . 2009-12-31 23:22 23248 ----a-w- e:\windows\system32\drivers\aswRdr.sys

2009-11-30 20:11 . 2009-12-31 23:22 100176 ----a-w- e:\windows\system32\drivers\aswmon2.sys

2009-11-30 20:11 . 2009-12-31 23:22 94544 ----a-w- e:\windows\system32\drivers\aswmon.sys

2009-11-30 20:11 . 2009-12-31 23:22 19024 ----a-w- e:\windows\system32\drivers\aswFsBlk.sys

2009-10-18 23:48 . 2009-12-31 23:22 27728 ----a-w- e:\windows\system32\drivers\aavmker4.sys

2009-10-11 19:36 . 2009-10-11 19:36 73728 ----a-w- e:\windows\system32\RtNicProp32.dll

2009-10-11 19:36 . 2009-10-11 19:36 143360 ----a-w- e:\windows\system32\drivers\Rtenicxp.sys

.

 

------- Sigcheck -------

 

 

[-] 2009-10-23 . E88631E21A9CACA06104802F9E915115 . 361600 . . [5.1.2600.5625] . . e:\windows\system32\drivers\tcpip.sys

 

 

[-] 2009-10-23 . C3AF0EEE26B59484E674673E3016AAB7 . 1056768 . . [5.1.2600.5781] . . e:\windows\system32\kernel32.dll

 

[-] 2009-10-23 . 6D290615A78C60746F4E25B2102573AF . 2640896 . . [5.1.2600.5755] . . e:\windows\system32\ntoskrnl.exe

 

[-] 2009-10-23 . BEE6ADE296912A058D88C51ABC458515 . 579584 . . [5.1.2600.5512] . . e:\windows\system32\user32.dll

 

[-] 2009-10-23 . 0E27A305F86583A1F5B61F3C7DDCC5A2 . 1859584 . . [6.00.2900.5634] . . e:\windows\explorer.exe

 

 

[-] 2009-10-23 . A9658459BB4F4EE00FA117C9382C0D3A . 1571840 . . [5.1.2600.5512] . . e:\windows\system32\sfcfiles.dll

 

 

 

[-] 2009-10-23 . A8300000232F40CC3E38885144BDECDD . 2519552 . . [5.1.2600.5755] . . e:\windows\system32\ntkrnlpa.exe

 

e:\windows\System32\drivers\beep.sys ... manque !!

e:\windows\System32\wuauclt.exe ... manque !!

e:\windows\System32\wscntfy.exe ... manque !!

e:\windows\System32\regsvc.dll ... manque !!

e:\windows\System32\schedsvc.dll ... manque !!

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2009-02-26 10:25 809864 ----a-w- e:\program files\Ask.com\GenericAskToolbar.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "e:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-26 809864]

 

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "e:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-26 809864]

 

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="e:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-31 39408]

"Skype"="e:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-22 1474560]

"Google Updater"="e:\program files\Google\Google Updater\GoogleUpdater.exe" [2009-12-31 160752]

"Google Desktop Search"="e:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-31 30192]

"TkBellExe"="e:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-12-31 198160]

"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"avast5"="e:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2009-11-30 2654512]

"IgfxTray"="e:\windows\system32\igfxtray.exe" [2008-02-15 135168]

"HotKeysCmds"="e:\windows\system32\hkcmd.exe" [2008-02-15 159744]

"Persistence"="e:\windows\system32\igfxpers.exe" [2008-02-15 131072]

"Google Quick Search Box"="e:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-01-01 122880]

"QuickTime Task"="e:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]

"ZoneAlarm Client"="e:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-09-23 1011080]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"_nltide_3"="advpack.dll" [2009-10-23 128512]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]

"NoAutoUpdate"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesOverride"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2536309916-560122738-865605030-500]

"EnableNotificationsRef"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"12530:TCP"= 12530:TCP:eMule_TCP

"65530:UDP"= 65530:UDP:eMule_UDP

"65535:UDP"= 65535:UDP:eMule_UDPServeur

 

R0 Si3124;Si3124;e:\windows\system32\drivers\si3124.sys [23/10/2009 20:00 76208]

R0 Si3531;Si3531;e:\windows\system32\drivers\Si3531.sys [23/10/2009 20:00 210224]

R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [01/01/2010 00:22 149840]

R1 GhPciScan;GhostPciScanner;e:\program files\Symantec\Norton Ghost 2003\GhPciScan.sys [28/05/2003 19:01 5632]

R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [01/01/2010 00:22 19024]

R3 QCAbsee;QuickCam Web Logitech (0801);e:\windows\system32\drivers\OVCA.sys [01/01/2010 00:35 25088]

S2 gupdate;Service Google Update (gupdate);e:\program files\Google\Update\GoogleUpdate.exe [01/01/2010 00:03 133104]

S3 epmntdrv;epmntdrv;e:\windows\system32\epmntdrv.sys [04/01/2010 09:58 13192]

S3 EuGdiDrv;EuGdiDrv;e:\windows\system32\EuGdiDrv.sys [04/01/2010 09:58 8456]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;e:\program files\Google\Google Desktop Search\GoogleDesktop.exe [01/01/2010 00:01 30192]

S3 maconfservice;Ma-Config Service;e:\program files\ma-config.com\maconfservice.exe [17/12/2009 19:00 243056]

 

--- Autres Services/Pilotes en mémoire ---

 

*NewlyCreated* - HELPSVC

*NewlyCreated* - SECLOGON

 

NETSVCS DOIT ÊTRE RÉPARÉ - liste des éléments présents

6to4

AppMgmt

AudioSrv

Browser

CryptSvc

DMServer

DHCP

EventSystem

FastUserSwitchingCompatibility

HidServ

Ias

Iprip

Irmon

LanmanServer

LanmanWorkstation

Netman

Nla

NWCWorkstation

Nwsapagent

Rasauto

Rasman

Remoteaccess

SENS

Sharedaccess

SRService

Tapisrv

Themes

TrkWks

WZCSVC

Wmi

WmdmPmSp

winmgmt

xmlprov

napagent

hkmsvc

BITS

ShellHWDetection

WmdmPmSN

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

 

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.ask.com/?o=101723&l=dis

mStart Page = hxxp://www.google.fr/

IE: E&xporter vers Microsoft Excel - e:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - e:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

FF - ProfilePath - e:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\h4ajjd4y.default\

FF - component: e:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\h4ajjd4y.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: e:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: e:\program files\Google\Google Updater\2.4.1808.5272\npCIDetect14.dll

FF - plugin: e:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: e:\program files\ma-config.com\nphardwaredetection.dll

.

- - - - ORPHELINS SUPPRIMES - - - -

 

Toolbar-ITBar7Layout - (no file)

Toolbar-ITBar7Position - (no file)

HKU-Default-Run-ccleaner - c:\program files\CCleaner\CCleaner.exe

HKU-Default-RunOnce-MPlayer2_FixUp - e:\windows\inf\unregmp2.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-04 14:14

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_USERS\S-1-5-21-484763869-1645522239-1177238915-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,40,64,6d,6b,f5,0b,18,46,95,63,ab,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,40,64,6d,6b,f5,0b,18,46,95,63,ab,\

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(1152)

e:\windows\system32\SETUPAPI.dll

 

- - - - - - - > 'lsass.exe'(1304)

e:\windows\system32\setupapi.dll

 

- - - - - - - > 'explorer.exe'(4088)

e:\windows\system32\msi.dll

e:\program files\Google\Quick Search Box\bin\1.2.1150.162\qsb.dll

e:\windows\system32\SETUPAPI.dll

e:\windows\system32\NETSHELL.dll

e:\windows\system32\credui.dll

e:\windows\system32\eappprxy.dll

e:\windows\system32\webcheck.dll

e:\windows\system32\WPDShServiceObj.dll

e:\windows\system32\PortableDeviceTypes.dll

e:\windows\system32\PortableDeviceApi.dll

.

------------------------ Autres processus actifs ------------------------

.

e:\program files\Alwil Software\Avast5\AvastSvc.exe

e:\windows\system32\igfxsrvc.exe

e:\program files\Skype\Phone\Skype.exe

.

**************************************************************************

.

Heure de fin: 2010-01-04 14:16:59 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-01-04 13:16

 

Avant-CF: 35 764 785 152 octets libres

Après-CF: 35 708 121 088 octets libres

 

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

 

- - End Of File - - 45D7EC069A1C7AC7ACB674FE82C89AD6

 

Merci de m'aider et bonne année 2010 à tous